Medical and dental practices have turnover. Front desk staff, hygienists, assistants, billing help, temps covering a leave — the roster changes more in a year than most owners stop to count. The paperwork side of a departure is usually handled well: final paycheck, badge collected, keys returned. The software side is where things quietly go wrong.
In practice assessments, we regularly find live logins belonging to people who left months ago. The practice management system. The imaging software. The clearinghouse portal. Sometimes the email account is still receiving mail, still auto-forwarding somewhere, still perfectly usable by anyone who has the password — including whoever else that person shared it with over the years.
Why this one is worse than it sounds
A dormant account is not just an unused account. It's an account nobody is watching. Nobody notices unusual logins on it, nobody questions activity under that name, and it doesn't appear on anyone's mental list of things to protect. If those credentials were reused on a personal site that later got breached — and reuse is the norm, not the exception — you've got a working key to patient records circulating in a password dump.
What good offboarding looks like in a practice
The goal is that access ends the same day employment does — not eventually, not when someone remembers:
- Keep a list of every system each role touches. Practice management, imaging, email, clearinghouse, payroll, e-prescribing, the lab portal, the supply vendor account. If it isn't written down, something gets missed every single time.
- Disable on the last day — don't delete. Disabling preserves records, audit trails, and anything in their mailbox you may need later.
- Forward and then close the mailbox. Route mail to a current staff member for a set period so patient and vendor messages don't vanish, then shut it.
- Check for forwarding rules and connected devices before closing anything, including personal phones still receiving practice email.
- Rotate anything shared. Shared logins are common in practices and hard to eliminate overnight — but a departure is the moment to change those passwords, every time.
- Log it. A one-line record of who was removed from what, and when, is exactly the documentation an audit or an insurance questionnaire asks for.
Then take the harder step: stop sharing logins
Most practices have at least one account "everyone at the front desk" uses. It feels efficient until you need to know who accessed a specific chart on a specific day — and HIPAA's audit control expectations assume you can answer that. Individual accounts cost nothing extra in most systems and turn an unanswerable question into a two-minute lookup. They also make offboarding trivial, because there's exactly one account to disable.
Pull your active user list from your practice management system and your email this week, and match every name to someone who still works here. Anything unmatched gets disabled today. Our free practice IT assessment includes this access review across all your systems — findings are yours either way.
Every practice has turnover; none of it has to leave a door open. One list, one habit, one line in the log — and the person who left in June leaves completely.
Andrew — Founder, NextGen Strategy Partners
Veteran-owned managed IT for the nonprofits, schools, behavioral health providers, and medical & dental practices of McHenry & Lake Counties. Request a free security assessment →